Type Confusion in PostgreSQL - CVE-2026-120141
Published: November 12, 2026
Vulnerability identifier: #VU166100
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120141
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to type confusion in PostgreSQL materialized set-returning functions, including json_populate_recordset(), when processing returned rows with different dynamic RECORD return types. A remote user can cause an affected function to return rows with different dynamic RECORD types to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-120141
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7